CVE-2026-69152

The brace-expansion npm library's expand() function fails to enforce maxLength while building comma-alternative intermediate arrays and padded sequences, allowing attacker-supplied brace patterns to consume unbounded memory or block the Node.js event loop. An attacker who can control the strings passed to the library — typically via an application that expands user-supplied glob-like patterns — can trigger a denial of service, with no confidentiality or integrity impact. The flaw affects all versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, and notably bypasses the earlier fix for CVE-2026-14257, so users who already applied that patch remain vulnerable. Because brace-expansion is almost always pulled in as a transitive dependency (e.g., via minimatch), the affected population is broad across the Node.js ecosystem, though only applications that feed untrusted input into the library are practically exploitable. No in-the-wild exploitation is currently known; a public advisory (GHSA-rgw5-rvv9-x895) is available and EPSS estimates a 0.6% chance of exploitation within 30 days.

What to do: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, or 5.0.9 depending on your major version branch, and re-run npm audit or a lockfile scan to locate transitive copies — patching CVE-2026-14257 alone is not sufficient. Where upgrading is not immediately possible, validate or length-limit user-supplied patterns before passing them to expand(), and prioritize remediation for internet-facing services that process untrusted glob-like strings.